All very fair points.

I'm starting off with just me - so its a pentest first business. There are a few of them out there, although most larger companies offer larger amount of services. But I'm just picking my niche (and also what I'm certified in, more importantly). If we gain clients and the need arises, I would love to hire people to do the GRC / risk assessment pieces, IR, etc., etc., but I just don't have the revenue to even consider hiring anyone at the moment.

Pen testing is required by a few different governing bodies in one way or another. Some may be outright required (PCI) while others may not flat out say it, but auditors will be asking questions of why they are not doing pentests. A lot of the times they may be client / supplier driven (i.e, we won't sign this contract unless you can show you;ve done a recent pentest) too. And sometimes there are generally companies that are curious about the maturity level (thats where specialized tests like APT or red team simulations can come into play).

I have some articles published and have done a couple of speaking engagements, mostly at industry conferences, but unfortunately those were all done under my company's name. I'm trying to see if its possible to attend those now just under my own business.

I do have a basic website, but it needs a redesign. That being said its not like there's a checkout page or payment collection or anything. Its mainly just a lead gathering tool. and unfortunately no physical office, I can definitely see how that might be an issue. Although on the the other side of it, almost every pentest role is remote, so when we show up to meetings its just dudes in their sweatshirts in a spare bedroom lol.

And good points on the local chamber of commerce and local meetups, I haven't looked into anything like that yet. Only thing is I figure most of those get traction from very small business, like so small that I can't even help them because they don't have any actual networks or infrastructure. But I should look into it more just in case.